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I. INTRODUCTION 



In the quantum folklore, the "uncertainty principle" is often taken to assert that it 
is impossible to observe a property of a quantum system without causing a disturbance 
to some other property. However, when we seek the quantitative meaning of this vague 
declaration, all we find are uncertainty relations such as Ax Ap > h/2, whose meaning 
is totally different. Such a relation means that if we prepare an ensemble of quantum 
systems in a well defined way (all in the same way), and we then measure x on some of 
these systems, and independently measure p on some other systems, the various results 
obtained in these measurements have standard deviations. Ax and Ap, whose product is 
no less than h/2. No reciprocal "disturbance" of any kind is involved here, since x and p 
are measured on different systems (following identical preparations). 

In this article, we shall give a quantitative meaning to the heuristic claim that obser- 
vation in quantum physics entails a necessary disturbance. Consider a quantum system 
prepared in a definite way, unknown to the observer who tests it. The question is how 
much information the observer can extract from the system (how well he can determine 
the preparation), and what is the cost of that information, in terms of the disturbance 
caused to the system. This seemingly academic question recently acquired practical im- 
portance, due to the development of quantum cryptography [1-3], a new science which 
combines quantum physics with cryptology. Following the established usage, the preparer 
of the quantum state will be called Alice, the observer who wants to get information while 
causing as little disturbance as possible will be Eve, and a subsequent observer, who re- 
ceives the quantum system disturbed by Eve, will be called Bob. (In the crypt ographical 
environment, Alice and Bob are the legitimate users of a communication channel, and 
Eve is the eavesdropper. The present paper discusses the situation in a general way, from 
the point of view of what is possible in physics, and is not concerned with any malicious 
motivations.) 

First, we must define the notions of information and disturbance. If Eve knows strictly 
nothing of j'^) (the state of the system that was prepared by Ahce), she can gain very 
little information by testing a single quantum system: for example, if she chooses an 
orthonormal basis |e„) and "measures," in the von Neumann sense of this term, an ob- 
servable corresponding to that basis, she forces the system into one of the states |e„). In 
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that case, the answer only tells her that IV') before the measurement was not orthogonal 
to the |e„) that she found. Meanwhile, the quantum state may be disturbed extensively 
in this process. On the other hand, if Eve definitely knows that the initial \ip) is one of 
the orthonormal vectors but she does not know which one of them it is, she can 
unambiguously settle this point by a non- demolition measurement [4], which leaves the 
state of the system unchanged. 

It is the intermediate case which is most interesting and has applications to crypto- 
graphy: Eve knows that Alice prepared one of a finite set of states |'0n), with probability 
Pn- However, these states are not all mutually orthogonal. Before Eve tests anything, 
a measure of her ignorance is the Shannon entropy H = —J^PrAogpn- She can reduce 
that entropy by suitably testing the quantum system and making use of Bayes's rule for 
interpreting the result (as explained in Section II). The decrease in Shannon entropy is 
called the mutual information that Eve has acquired. The problem we want to investigate 
is the tradeoff between Eve's gain of information, and the disturbance caused to the 
quantum system. 

A convenient measure for this disturbance is the probability that a discrepancy would 
be detected by Bob, if he knew which state was sent by Alice, and tested whether 

the state that he gets after Eve's intervention still is |V^n)- In that case, what Bob receives 
is not, in general, a pure state, but has to be represented by a density matrix p„. The 
disturbance (discrepancy rate) detectable by Bob is 

D = l-(^„|p„|^„). (1) 

Note that the mutual information and discrepancy rate, as defined above, may not 
be the quantities that are most relevant to applications in quantum cryptography [5]. 
An eavesdropper may not want to maximize mutual information, but some other type of 
information, depending on the methods for error correction and privacy amplification [6] 
that are used by the legitimate users. Likewise, the protocol followed by Bob may not be 
to measure \ipn){'4^n\ for a particular n, but to perform some other type of measurement. 
In the present paper, we have chosen mutual information and the discrepancy rate (1) for 
definiteness (other possible choices are briefly discussed in the final section). 

In Section II of this article, we investigate the process outhned in Fig. 1. Ahce prepares 
a quantum system, in a state pa (for more generality, we may assume that this state is 
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not pure and must be represented by a density matrix). Eve likewise prepares a probe, 
with state pe- The two systems interact unitarily, 



PA^pE-^ p' = U (pa ® Pe) U\ (2) 

and their states become entangled. Bob receives the system that Alice sent, in a modified 
state, 

Pb = TrE(p'), (3) 

where Trg means that the degrees of freedom of Eve's probe have been traced out (since 
they are inaccessible to Bob). Bob may then test whether this pg differs from the pa that 
was prepared by Alice. In the simple case where pa is a pure state, the discrepancy rate 
is D = 1 - Tr(pAPB), as in Eq. (|lD. 

How much information can Eve gain in that process? Her probe comes out with a state 

Pe = TrB(p'), (4) 

with notations similar to those in Eq. (|^). Now, to extract from p^ as much information 
as possible. Eve should not, in general, perform a standard (von Neumann type) quantum 
measurement [7], whose outcomes correspond to a set of orthogonal projection operators. 
A more efficient method [8, 9] is to use a positive operator valued measure (POVM), 
namely a set of non- negative (and therefore Hermitian) operators i?^, which act in the 
Hilbert space of Eve's probe, and sum up to the unit matrix: 

E^M = 1- (5) 

Here, the index p labels the various possible outcomes of the POVM (their number may 
exceed the dimensionality of Hilbert space). The probability of getting outcome p is 

P, = TriE,p'^). (6) 

Such a POVM can sometimes supply more mutual information than a von Neumann 
measurement. 

Of course Eve cannot measure all the E^j, simultaneously, since in general they do not 
commute. What she may do is to adjoin to her probe an ancilla [8, 9] (namely an auxiliary 
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system which does not directly interact with the probe), and then to perform an ordinary 
von Neumann measurement on the probe and the ancilla together (it is the measuring 
apparatus that interacts with both of them). The advantage of the POVM formahsm, 
Eqs. (!]) and (P), is that it does not require an exphcit description of the ancilla (just 
as the von Neumann formalism does not require an explicit description of the measuring 
apparatus). 

Here, the reader may wonder why we did not consider Eve's probe, and her ancilla, 
and perhaps her measuring instrument too, as a single object. The answer is that a di- 
vision of the process into two steps has definite advantages for optimizing it, as will be 
seen in detailed calculations in Section III. Moreover, in some cryptographical protocols 
[1, 2], Alice must send to Bob, at a later stage, classical information over a public channel. 
Eve, who also receives that information, may in principle postpone the observation of her 
probe until after that classical information arrives, in order to optimize the POVM that 
she uses for analyzing her probe. This would not be possible if the two steps in Fig. 1 
were combined into a single one. 



II. INFORMATION-DISTURBANCE TRADEOFF 

Let {|em)}, m = 1, . . . A^, be an orthonormal basis for the A^-dimensional Hilbert 
space of the system sent by Alice to Bob, and let {|fa)} be an orthonormal basis for Eve's 
probe. The dimensionality of the latter has to be optimized (see next section). First, 
assume for simplicity that Alice sends one of the orthonormal states \em), and that Eve's 
probe too is prepared in one of the states \va)- (Results for other initially pure states 
can be derived by taking linear combinations of the equations below. Mixed states can 
then be dealt with by rewriting these equations in terms of density matrices, and taking 
suitable weighted averages of the latter.) The unitary evolution in Eq. (^) becomes, in 
the case we are considering, 

I Cm; "^a) U I Cm; ^a) ^ ^ -^mna/S |Cn, 

vp), (7) 

n/3 

where the notation 

|em,^^Q) = km) ® \Va), (8) 
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was introduced, for brevity. The numerical coefficients Amnap are the matrix elements of 
U: 

Amnafi = {Cn, Vfs\U\em, Va) ■ (9) 

In the following, we shall drop the index a: any mixed state for Eve's probe can always 
be thought of as arising from a partial trace over the degrees of freedom of a larger probe 
prepared in a pure state. We therefore assume that the probe's initial state is pure; since 
the dimensionality of its Hilbert space still is a free variable, this will cause no loss in 
generality. Moreover, the final optimized results are completely independent of the choice 
of that initial state (because any pure state can be unitarily transformed into any other 
pure state). The index a is therefore unnecessary. We thus obtain from Eq. the 
unitarity conditions 

^m'nl3 = ^mm' ■ (10) 

The final state, when Alice sends |em), can also be written as 

Vp) =Y.\^n) ®\^mn), (H) 

where 

\^mn) = J2^rnnl3 IVfs), (12) 
/3 

is a pure state of the probe. It is from these states and their linear combinations that Eve 
will glean her information. Note that, irrespective of the choice of U, i.e., for an arbitrary 
set of AmnjSi there can be no more than N"^ linearly independent vectors |$mn)- That is 
to say, the A^^ vectors |$mn) span, at most, an A^^-dimensional space. Therefore there is 
no point in using a probe with more than A^^ dimensions if its initial state is taken to be 
pure. (If the initial state of the probe is a density matrix of rank fc, the final states of 
that probe span a Hilbert space of dimension not exceeding kN"^.) This point is crucial 
for any optimization problem based solely on Eve's measurement outcome statistics, not 
just the one for mutual information, which is considered here. It effectively delimits the 
difficulty of any such problem, reducing it to computable proportions. 
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As we shall see, it is convenient to replace the (3 index in Eq. (|T0|), which may take A^^ 
values, by a pair of Latin indices, such as rs, where r and s take the same values as m 
or n. We shall thus write Amnrs instead of A^np- 

We now restrict our attention to the case where the quantum system prepared by Alice 
is described by a two-dimensional Hilbert space (for example, this may be the polarization 
degree of freedom of a photon). The two dimensions will be labelled and 1, so that Amm-s 
runs from Aqooo to Aim. This quadruple index can then be considered as a single binary 
number, and we thus introduce the new notation: 

(7^ = 0, ... ,15). (13) 

The unitary relation ( pUj ) becomes 

7 15 

X! I^^l = X! = 1, 

(14) 

K=0 

To further simplify the discussion, we assume that Alice prepares, with equal proba- 
bilities, one of the pure states shown in Fig. 2(a): 

|0) = cosa |eo) + sina |ei), 

(15) 

|1) = cos a |ei) + sin a |eo). 

By a suitable choice of phases, such a real representation can always be given to any two 
pure states. Their scalar product will be denoted as 

5 = (0|1) = sin2a. (16) 

These notations are manifestly symmetric under an exchange of labels, 0^1. Since 
the two states are emitted with equal probabilities, it is plausible that the optimal strategy 
for Eve is to use instruments endowed with the same 1 symmetry, so that ($oo|^oi) = 
(<l>ii|<l>io) and ($oo|'&io) = ('^'iil'^'oi)- In particular, if Eve's \vrs) basis is chosen in an 
appropriate way (as explained below), the set of Amnrs also has the 01-symmetry, namely 
Amnrs = Amnfs, wherc TTi = 1 — m, etc. This relationship can be written as 

= ^K, (17) 
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and the unitary relations ([T^) become 
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K\ 
K=0 

7 

K=0 



Furthermore, we can safely drop the complex conjugation sign, since the signal states ( [T5| ) 
involve only real coefficients. There is no reason for introducing complex numbers in the 
present problem. 

Still more simplification can be achieved by rotating the |f^) basis in a way that does 
not conflict with 01-symmetry. For example, in Eq. (|1^), we may arrange that the vectors 
|foi) and |fio) lie in the plane spanned by the vectors |$oi) and |$io), and that they are 
oriented in such a way that ($oi|'i^oi) = ('^'lol'^^io), because we want to have Aqioi = ^loio 
(no further rotation is then allowed in that plane). This is illustrated in Fig. 2(b). Note 
that we automatically have ($oi|'^^io) = ("^loK'oi)) since |$oi) and |$io) have the same 
length, thanks to the 01-symmetry. The vectors |foo) and |fii) are orthogonal to the 
plane spanned by |foi) and |fio)- We likewise have to rotate them in their plane, so as to 

have ($oo|^^oo) = ('^'iil^^ii), and ($oo|^^ii) = ('^'iil^^oo)- 

With this choice of basis vectors for the probe, the Amnrs coefficients obey the 01- 
symmetry, and moreover we have Aqioo = ^oiii = 0, so that 

X4 = Xr = 0. (19) 

The unitary relations (0) become 

x^ + xf + xi + xi + xl + x', = 1, 

X,X, + X2X, = 0. 



(20) 



The six surviving Xk can then be represented by four independent parameters. A, fi, 9, (f), 
as follows: 

Xo = sin A cos fi, X3 = sin A sin fi, 

Xi = cos A cos 6* cos(/), X2 = cos A cos 6' sine/), (21) 

X5 = cos A sin 9 cos 0, Xq = — cos A sin 9 sin (p. 
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We are now ready to investigate the tradeoff between the information acquired by Eve 
and the disturbance infficted on the quantum system that Bob receives. Let 



l^) = Ecm|e™), (22) 

m 

be the pure state sent by Ahce, e.g., one of the two signal states in Eq. (0). After Eve's 
intervention, the new state is 

1^') = X! Cm \en,Vp), (23) 

mnf) 

and the density matrix of the combined system is p' = (Here, we temporarily 

returned to using a single Greek index (3 for Eve's probe, instead of the composite rs 
index.) The reduced density matrices, for the two subsystems considered separately, are 
then given by Eqs. (0) and (^. Explicitly, we have, 

(PB)mn = X] '^nl3, (24) 

/3 

and 

(Pe)/37 = X! Ym^, (25) 

m 

where 

Ynl3 = ^Cm Amnl3- (26) 

m 

The discrepancy rate observed by Bob is given by Eq. ([|): 

mn p 

where 

Zp = '^Cn Ynp = '^CmCn AmnP- (28) 
n mn 

Explicitly, we have, when 01-symmetry holds, 

Zoo = clXo + clXs, (29) 
Zoi =clXi + coci (Xs + Xe) + 0^X2, (30) 



Zio = clX2 + coci (X5 + Xe) + cl Xi, (31) 

Zn=clXs + clXo. (32) 

With the help of Eqs. (^, (0), and (|2T|), we finally obtain 
= cos^ A sin^ 9 - (5/2) cos^ A sin 2^ cos 20 

(33) 

+ (572) [sin^ A (1 - sin 2fi) + cos^ A cos 2^ (1 - sin 20)]. 
We now turn our attention to Eve, whose task is to gather information about whether 
Alice sent |0) or |1). That is, Eve must distinguish two different density matrices of type 
(p5|), which differ by the interchange of cq and ci. Let us denote these density matrices 
as p[, with i = 0,1. 

Eve chooses a suitable POVM with elements E^, as in Eq. (1). From Eq. @, the 
probability of getting outcome /i, following preparation p-, is 

P,i = TT{E,p',). (34) 

Having found a particular /i. Eve obtains the posterior probability for preparation p[, 
by means of Bayes's rule [10]: 

Qifi = PfiiPi/qf,, (35) 
where 

% = Y.PmPv (36) 
i 

is the prior probability for occurence of outcome p. 

The Shannon entropy (Eve's level of ignorance), which initially was H = —J2Pi logPii 
now is, after result fi was obtained, 

H^, = -J2 Qif^ log Qit^- (37) 

i 

Therefore the mutual information (namely. Eve's average information gain) is 

I = H-Y^q^H^. (38) 

This quantity depends both on the properties of Eve's probe (the various Amn^) and the 
choice of the POVM elements i?^. 
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III. OPTIMIZATION 



If Eve wants to maximize the mutual information /, she has to choose the POVM 
elements in an optimal way. This is a complicated nonlinear optimization problem, 
for which there is no immediate solution. There are, however, useful theorems, due to 
Davies [11]. Firstly, an optimal POVM consists of matrices of rank one: 



(To be precise, there may be POVMs made of matrices of higher rank, that give the same 
mutual information as these optimal matrices of rank one, but they can never give more 
mutual information.) 

Secondly, the required number, N^j, of different vectors \w^), is bracketed by 



where N is the dimensionality of Hilbert space. A rigorous proof of this relationship, 
given by Davies [11], is fairly intricate. A plausibility argument (not a real proof) can 
be based on the reasoning subsequent to Eq. ([121) . If the POVM is implemented by an 
instrument obeying the laws of quantum mechanics, the interaction with this instrument 
is unitary. Therefore, the instrument's final state after the interaction must reside in a 
fixed subspace of no more than A^^ dimensions (if the initial state of the instrument was 
pure). When we perform a von Neumann measurement on the instrument — which is the 
upshot of the POVM procedure — it is thus plausible that it should never be necessary to 
involve more than A^^ distinct outcomes. 

In the present case, = 4 (the number of dimensions of Eve's probe), and Davies's 
theorem guarantees that Eve does not need more than 16 different vectors \Wf^), subject 
to the constraint J2fi ~ ^- Moreover, while there are cases where the upper limit 

in (1^) is indeed reached (an example is given in Davies's work), there also are cases for 
which it is known that A^^ need not exceed A^. It is so when we have to distinguish two 
pure states, or even two density matrices of rank 2, lying in the same two-dimensional 
subspace of Hilbert space [12]. It has been conjectured [12] that this is also true for 
any two density matrices of arbitrary rank. In the absence of a formal proof, we tested 
that conjecture numerically, for more than a hundred pairs of randomly chosen density 



(39) 



N <N^< N^, 



(40) 
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matrices, with = 3 or = 4. Using the Powell algorithm [13], we tried various values 
of in the range given by Eq. (^Ol). In all these tests, it never happened that the number 
of vectors had to exceed (namely, whenever we tried A^^, > A^, we found that some of 
the optimized vectors were parallel, and there were only A^ independent \w^).) 

Therefore, in the present case, we assume Eve only has to find the optimal 4-dimensional 
orthonormal basis {Iw^)}- (This result might have been expected, in view of the above 



argument for the plausibility of Eq. (40), because in an optimal unitary evolution there 
cannot be more than four different final outputs, if there are two inputs.) We thus have 
now a standard optimization problem, which can be solved numerically (the orthonormal- 
ity constraint must be handled carefully, though, so that iterations converge). However, 
Eve has an additional problem, which is to find the optimal unitary interaction for her 
probe, in Eq. (^. She must therefore include, in the optimization procedure, the four 
angles A, /x, 9, 0, defined in Eq. (^I]). Moreover, she may also want to control the 
disturbance D, given by Eq. (|33|). 

Many different tradeoffs can be chosen, when we want to maximize / and to minimize D. 
A simple figure of merit could be M = / — kD, where the positive coefficient k expresses 
the value of the information /, compared to the cost of causing a disturbance D. We 
could also imagine other, more complex figures of merit, involving nonlinear functions 
of / and D. With cryptographical applications in mind, we investigated the problem of 
maximizing I subject to the constraint D < -Dtoh so that the disturbance be less than a 
certain tolerable one. This was done by maximizing the function M = J— 1000 (D — Dtoi)^, 
for many randomly chosen values of a in Eq. (|T5|). 

In all the cases that we tested, the optimization procedure led to A = (or to an 
integral multiple of vr) in Eq. (0). This implies Xq = = 0, and since we already have 
X4 = Xj = 0, this means that Vrs, Arsoo = ^rsii = 0, and therefore |$oo) = = 0. 

We remain with only |$oi) ai^d |$io)- In other words. Eve's optimal probe has only two 
dimensions, not four. 

We have no formal proof for this result, which was found by numerical experiments. 
However, this result is quite plausible: it is clear from Eq. (^) that D is an even function 
of A, and therefore is extremized when A = 0. Unfortunately, it is more difficult to evaluate 
explicitly the mutual information J, which is a complicated function of the matrix elements 
{p'^)mn,rs in Eq- (P^)- Howevcr, when we write explicitly these matrix elements, we see 
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that they are even or odd functions of A, according to the parity of the sum of indices, 
{m + n + r + s). This symmetry property then holds for any product of such matrices, 
and the trace of any such product always is an even function of A. Since / is a scalar, 
i.e., is invariant under a change of the basis, it is plausible that / can be written, or at 
least approximated, by expressions involving only these traces, so that / also is an even 
function of A. Therefore A = is an extremum of our figure of merit, and it might be 
possible to prove, with some effort, that A = indeed gives the global maximum of the 
figure of merit. Anyway, the validity of this result is likely to be restricted to the highly 
symmetric case where Alice prepares two equiprobable pure states, as in Eq. (|15|). 

However, once this result is taken for granted, the calculation becomes considerably 
simpler, and can be done analytically, rather than numerically. First, we note that, by 
virtue of the 01-symmetry, Eve's two density matrices can be written as 

/ a c\ / b c\ 

Po=( J, and p[=( J, (41) 

with a + b = 1. These two matrices have the same determinant, 

d = ab-c'^ >0. (42) 

In that case, the mutual information that can be extracted from them is explicitly given 
by [12, 14]: 

/ = [(1 + z) log(l + z) + {l-z) log(l - z)]/2, (43) 
where 

z = [1 - 2rf - Tr (p[, p;)]^/2 ^ (1 _ 4a5)i/2_ (44) 
We therefore need only the diagonal elements in (^51). These are, by virtue of (plf ) and 



(Pe)oi,oi = E^noi, (45) 

n 

= (coXl + ClX6)' + (coX5 + ClX2)^ (46) 

= (l + cos2a cos20)/2, (47) 

and likewise 

(Pe)io,io = (1 - cos 2a cos 20)/2, (48) 
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where a is the angle defined in Eq. (p!5|). (Here, to conform with our earher notations, 
each one of the two dimensions of the probe's space is denoted by a double index, 01 or 
10.) We thus obtain 

2; = [1 - 4 (pe)oi,oi (Pe) 10,10]^^^ = cos 2a cos 20. (49) 



When substituted in Eq. (^5[), this result gives a remarkably simple expression for the 
mutual information. In particular, / does not depend on Q. 
The discrepancy rate given by Eq. (p3D, also simplifies: 



L) = sin^ ^ - (5/2) sin 2^ cos 20 + (^72) cos 20 (1 - sin 20), (50) 
whence 

2D = 1 - 5 cos 20 sin 1Q-\\- (1 - sin 20)] cos 29. (51) 
For each 0, the angle 6 = 60 making D minimal is given by 

tan 200 = 5 cos 20 / [1 - 52 1 - sin 20)] , (52) 

and that minimal value of D is 

2Do = 1 - {S^ cos^ 20 + [1 - (1 - sin 20)]2}i/2. (53) 
Let us consider various values of 0. For = 0, we obtain the maximal value of /: 
-^max = log 2 + cos^ a log(cos^ a) + sin^ a log(sin^ a), (54) 

as could have been found more directly. The minimal disturbance corresponding to this 

I max is 

Di = [l-{1-S^ + S^Y'^]I2. (55) 



Clearly, it is possible to have Dq < Di only by accepting / < /max- By solving Eq. ([53| ) 
for and using Eq. (|55|) , one gets an explicit relation between the maximal information 
and the minimal disturbance caused by the measurement. This is given by Eq. (^Hf) with 



z = cos 2a 



Doil-Do)/D^{l-D^ 



1/2 



(56) 
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This relation completely specifies the information-disturbance tradeoff. The result is 
plotted in Fig. 3 for three values of the angle a defined by Eq. (0), namely a = 7r/16, tt/S, 
and 7r/5 (these are the values that were investigated in ref. [5]). 

The limit Do is obtained for = (7r/4) — (e/2), with e — 0. We then have 

/ ^ ^72 ^ (e cos2a)V2, (57) 

and 

Do ^ (^2 - ^^)/16 ~ (/ tan 2a) 74. (58) 

The quadratic behavior, Dq which was derived for the pair of non-orthogonal signals 
in Eq. (p!5D , may however not hold for more complicated types of quantum information 
[15], such as the two orthogonal pairs in ref. [1]. 

Finally, let us examine the correlation between the result observed by Eve and the 
quantum state delivered to Bob. We can write Eq. (121) as 



W) = Y.\i''p)®\^p)^ (59) 
where 

Wp) = ^Cyn Amnf3 |e„), (60) 
mn 

is (except for normalization) the state received by Bob whenever Eve observes outcome 
(3. For example, if Alice sends |0) and Eve observes |foi). Bob receives 

iVdi) = (coXi + ciX6)|eo) + (coX5 + ciX2)|ei), (61) 
= (cos a cos 6 cos — sin a sin 6 sin 0) |eo) 

-|- (cos a sin 9 cos -|- sin a cos 9 sin 0) |ei). (62) 

Note that 

ll^oiir = cos^ a cos^ + sin^ a sin^ 0, (63) 

is the probability that Bob gets iV^oi) when Alice sends |0) and Eve observes |foi). 

Let us consider two extreme cases. If = 7r/4, so that Eve obtains no information, 
we may choose 6' = in accordance with Eq. (|5^), and it then follows from Eq. (|SD|) that 
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there is no disturbance at all. Indeed, in that case, the U matrix in Eq. (|^) simply is a 
unit matrix. 

On the other hand, if = so that Eve acquires all the accessible information. Bob 
receives, with probability cos^ a, a state 

= cos6' |eo) + sin6' |ei). (64) 

(The tilde indicates that this state has been normalized.) The angle 6 that minimizes D 
is given by Eq. (0), which now becomes 

tan 29 = S/{1 — S'^) = sin 2a/ cos^ 2a = tan 2a/ cos 2a. (65) 

Everything happens as if, when Eve observes the state closest to |0), she sends to Bob, 
not |0), but a slightly different state |0'), with a new angle 6, slightly larger than a. For 
example, if a = 22.5°, we have 9 = 27.3678°. These angles are illustrated in Fig. 4. It 
must however be pointed out that, in the scenario described in Fig. 1, Eve releases Bob's 
particle before observing her probe. What she actually has to do is to make them interact 
with the appropriate U, and this guarantees that the final state is correctly correlated, as 
in Eq. (^). 



IV. OTHER TRADEOFF CRITERIA 



Until now, we used D in Eq. (|I]) as a measure of the disturbance: this was the probabil- 
ity for an observer to find the quantum system in a state orthogonal to the one prepared 
by Alice. This may not always be the most useful criterion, and in some cases it indeed 
is a very poor one. For example, if the two states in Eq. (|l^) have a close to 7r/4, the 
states sent to Bob will be even closer to 7r/4, as may be seen from Eq. (|65|) . The states 
themselves change very little, but the information that they carry is drastically reduced, 
as the following example shows. 

Consider the case a = 7t/5 (depicted by the lowest line in Fig. 3). Eve then has 
-^max = 0.048536. Let us rename this expression Jae (the mutual information for Alice 
and Eve). Two different mutual informations can likewise be defined for Bob: Jeb, namely, 
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what Bob may be able to know on the resuh registered by Eve, and Jab, what he may 
still be able to know on the original state, prepared by Alice. 

The calculation of Jeb is easy. As explained after Eq. (|65|), everything happens as if 
Eve would knowingly send to Bob one of two pure states, like those in Eq. (^), but with 
a = 36° replaced by ^ = 42.1332°. We then have, from Eq. Ieb = 0.0049987, about 
one tenth of Jae- 

What Bob may still be able to know about the state that was sent by Alice is even less 
than that. Bob receives the quantum system in a state described by the density matrices 



(P^). Due to 01-symmetry, these matrices have the same form (|41|) as those of Eve, and 



the mutual information Jab is again given by Eqs. ( ^31 ) and (|4^). Now, however, 

« = (Pb)oo = Y^l, + Fo'io = (co X, + ci Xef + (co X2 + ci X,)\ (66) 
and 

b = (Pb)ii = n'oi + n'lo = (Co X, + ci X2)' + (Co + c, X,)^. (67) 
It follows that, regardless of the value of 

z = cos 2a cos26'. (68) 

If we now take 6 given by Eq. (^), we obtain z = 0.0308718, whence Iab = 0.0004766. 
This is more than a hundred times smaller than the mutual information Bob could have 
had if Eve's probe had not been in the way! Thus, in that sense. Eve caused a major 
disturbance, even though it was as small as it could be by the previous criterion (for the 
given amount of information she gains). 

Note however that Eve, who controls both </> and 6, could just as well set 6 = 0. In 
that case. Bob would be able to recoup all the mutual information sent by Alice, simply 
by measuring the orthogonal states forwarded on to him. Nevertheless this scenario can 
hardly count as a minimally disturbing intervention on Eve's part, because in that case 
D = S^/2 = 0.452254, as can be seen from Eq. (H). 

What appears to be needed is a measure of disturbance that is itself of an information 
theoretic nature. There are many ways of comparing the states sent by Alice to the states 
received by Bob, that have more information-theory flavor than the measure used in the 
previous sections. For instance, one might consider using the KuUback-Leibler relative in- 
formation [16]. The latter quantifies the discrepancy between the frequencies of outcomes 
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for a quantum measurement on Alice's states, versus that same measurement on Bob's 
states [17]. Or, one might consider using the Chernoff information [16], which quantifies 
Bob's difficulty in guessing whether Eve has tampered with the state (in a given way) or 
not [17]. In any case, the best measure of disturbance is the one that is relevant to the 
actual application in which we are interested. 
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Captions of figures 

FIG. 1. Eve's probe interacts unitarily (U) with the particle sent by Alice to Bob, and 
is then subjected to a generalized measurement (M). 

FIG. 2. Choice of basis for signal states (a) and probe's states (b). 

FIG. 3. Maximal mutual information / obtainable for a given disturbance for two 
equiprobable pure input signals. The angle a is defined by Eq. ([T5|) . The dashed lines 
represent the maximal obtainable /, which cannot be exceeded by accepting a further 
increase of D. 

FIG. 4. States |0) and |1) are sent by Alice, and states |0') and |1') are resent by Eve, so 
as to cause the least possible disturbance rate in Bob's observations. 
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